CVE-2026-126388

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.46.1

Description An issue exists where Authorization headers and basic auth credentials are forwarded during cross-origin redirects. This occurs because the sendCredentialsOnCrossOriginRedirect setting defaults to true. An attacker who controls a redirect target or an expression-fed URL in nodes that use credentials can capture the stored workflow credentials sent to their endpoint.

Recommendations Update n8n to version 2.46.1 or later. As a temporary mitigation, set the sendCredentialsOnCrossOriginRedirect variable to false.